Mitmweb API Authentication Bypass Using Proxy Server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-288.
Summary
mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious client can use mitmweb's proxy server (bound to `*:8080` by default) to access mitmweb's internal API (bound to `127.0.0.1:8081` by default). In other words, while the cannot access the API directly, they can access the API through the proxy. An attacker may be able to escalate this SSRF-style access to remote code execution. The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. This vulnerability has been fixed in mitmproxy 11.1.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mitmproxy | mitmproxy | before 11.1.2 | 11.1.2 | Patch available | CNA |
| — | mitmproxy (PyPI) | before 11.1.2 | 11.1.2 | Patch available | GHSA-wg33-5h85-7q5p |
- mitmproxy Vendormitmproxy Affected before 11.1.2 Fixed in 11.1.2 Patch available CNA
- mitmproxy (PyPI) Vendor— Affected before 11.1.2 Fixed in 11.1.2 Patch available GHSA-wg33-5h85-7q5p
Remediation
- Fix · CNA mitmproxy (mitmproxy) Fixed in 11.1.2
- Fix · GHSA-wg33-5h85-7q5p mitmproxy (PyPI) Fixed in 11.1.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-23217
- 2026-10-03 Alias added: GHSA-wg33-5h85-7q5p
References
Other 6
- https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-wg33-5h85-7q5p
- https://en.wikipedia.org/wiki/Server-side_request_forgery
- https://github.com/mitmproxy/mitmproxy/blob/main/CHANGELOG.md#06-february-2025-mitmproxy-1112
- https://github.com/mitmproxy/mitmproxy/commit/fa89055e196d953f11fd241e36ee37858993486a
- https://github.com/mitmproxy/mitmproxy
- https://github.com/mitmproxy/mitmproxy/blob/main/CHANGELOG.md
More mitmproxy vulnerabilities
- TI-2022-08580 Insufficient Protection against HTTP Request Smuggling in mitmproxy CVSS 3.1CRITICAL 9.8
- TI-2021-16599 Lacking Protection against HTTP Request Smuggling in mitmproxy CVSS 3.1CRITICAL 9.8
- TI-2018-10406 mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py. CVSS 3.0HIGH 8.8
- TI-2024-25761 pdoc embeds link to malicious CDN if math mode is enabled CVSS 3.1N/A 0.0
- TI-2026-29342 ProxyAuth Addon LDAP Injection in mitmproxy CVSS 3.1MEDIUM 4.8
Sources
- CVE-2025-23217 · CVE Program
- CVE-2025-23217 · NVD
- FIRST EPSS
- GHSA-wg33-5h85-7q5p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences